Introduction to GitHub Repo Malware Threat
Researchers at Mozilla's Zero Day Investigative Network (0DIN) AI security platform have discovered a method to trick AI coding agents into running malware from a clean GitHub repository. This method, demonstrated by the researchers, relies on three components that separately represent no threat and raise no suspicion.
Components of the Attack
The three components of the attack are: a clean-looking GitHub repository with standard setup instructions, a Python package designed to refuse execution until it has been initialized, and a DNS TXT record controlled by the attacker. The Python package generates an error instructing the user to execute a specific command, which Claude Code treats as a normal setup issue and automatically runs while attempting to recover from the error.
Executing this command calls a shell script that retrieves the configuration value stored in the DNS TXT record controlled by the attacker, and is executed as a command. This approach requires no malicious component in the cloned repository, and the agent automates the entire attack chain, including a step that mimics a common user error.
Consequences of the Attack
If the attack is successful, the attacker would obtain a shell running with the developer’s privileges, giving them access to environment variables, API keys, local configuration files, and the opportunity to establish persistence. As 0DIN researchers explain, "Claude Code never decided to open a shell. It decided to fix an error. The reverse shell is three indirection steps away from anything Claude Code actually evaluated: an error message it trusted, a script that fetched a value, and a DNS record it never saw."
The researchers warn that threat actors could easily distribute such GitHub repositories through fake job postings, tutorials, blog posts, or direct messages. To prevent such exploitation, 0DIN suggests that AI agents should disclose the full execution chain of setup commands, including scripts and code fetched dynamically at runtime.
Prevention and Mitigation
To mitigate the risk of such attacks, it is essential to test every layer of the setup process before attackers do. Security teams should log all successful attacks and alert on any suspicious activity. The Picus whitepaper shows how breach and attack simulation tests can help prevent threats from slipping by detection.
- Test every layer of the setup process before attackers do
- Log all successful attacks and alert on any suspicious activity
- Use breach and attack simulation tests to prevent threats from slipping by detection
By taking these steps, developers and security teams can reduce the risk of falling victim to such attacks and protect their systems and data from malicious actors.
Related Research
Anthropic is testing desktop-like Claude Cowork for mobile, and has rolled out Claude Fable 5, but it's available for a limited time. OpenClaw AI agent was found falling for phishing attacks, spilling user data. Anthropic confirms Claude Mythos-class models will roll out to the public, and the restricted Claude Mythos model may be coming to Claude Code.
“The attacker now has an interactive shell running as the developer's own user.”
Source: BleepingComputer